Risk factor changes · MSFT

What changed in Microsoft's risk factors

Item 1A (Risk Factors) of Microsoft's FY2026 10-K compared with its FY2025 10-K, sentence by sentence.

Newer: 10-K filed 2026-07-29 · Older: 10-K filed 2025-07-30

New in the latest 10-K 105

• Statements in this section reflect our beliefs and opinions as to matters that could adversely affect us in the future.
• References to past events are provided by way of example only and are not intended to be a complete listing or a representation as to whether or not such matters have occurred in the past.
• Firms offering competing platforms may make it more difficult to attract and retain customers.
• Expansion of our vertically-integrated capabilities, including developing proprietary hardware, infrastructure, and artificial intelligence ( AI ) models, could increase our cost structure, reduce margins, and expose us to operational risks.
• Business model competition Companies compete with us based on a growing variety of business models.
• Our AI offerings compete with AI products from hyperscalers, open-source offerings, and frontier model providers, some of which are also current or potential partners.
• Our cloud and AI strategy requires substantial investments and depends on evolving customer demand, technological developments, competitive dynamics, and regulatory conditions, any of which could adversely affect our business, financial condition, and results of operations.
• We have made and are continuing to make significant capital and operational investments to develop, train, deploy, and support AI models and related cloud-based services, including building and expanding datacenters, acquiring necessary components, and securing energy resources.
• These investments are being made at significant scale and on an accelerated timeline, require substantial and increasing capital expenditures and continued access to capital, and are in advance of fully developed revenue streams.
• The associated revenue may not be realized in the expected timeframes or at expected levels.
• Our capital and operational investments are complex and involve projects in multiple locations around the world that expose us to increased compliance risks and political challenges, among others.
• Our ability to fund these investments depends on our ability to generate sufficient cash flows and obtain financing on acceptable terms.
• Adverse changes in interest rates, credit markets, investor sentiment, our credit ratings, or other factors affecting capital availability could increase our cost of capital or limit our ability to execute our infrastructure strategy.
• The financial success of these investments depends on a number of uncertain factors, including customer demand for cloud-based and AI products and services and continued customer use of Azure to build, train, deploy, and run AI workloads, our ability to price and monetize those services at levels sufficient to recover our costs, competitive dynamics affecting pricing, and the pace of adoption of AI.
• Customers may reduce, delay, or shift AI workloads to competing platforms, on-premises or local deployments, or other alternatives.
• If adoption of our AI services develops more slowly than expected, or if customers do not continue to utilize Azure for AI workloads at anticipated levels, we may not realize the expected returns on our investments. 15 PART I Item 1A Demand for cloud-based and AI products and services is evolving and difficult to forecast.
• Overestimation of demand or misalignment of capacity investments may result in underutilization of infrastructure and may lead to impairment of assets on our balance sheet.
• Conversely, demand exceeding available capacity limits our ability to meet customer needs in a timely manner.
• The cost structure for AI products and services is subject to significant uncertainty, including with respect to model training and inference costs, the availability and pricing of components, and energy costs.
• If these costs increase, remain elevated, or fail to decline, or if pricing for AI products and services declines as a result of competition, commoditization, or other market forces, our margins, financial condition, and results of operations could be adversely affected.
• Our AI strategy also depends in part on strategic relationships with third parties that provide technologies, models, products, and services that enhance our offerings.
• These relationships may change over time, and many of these partners compete with us with respect to certain products and services.
• Changes in strategic priorities, contractual arrangements, our access to third-party technologies, or key commercial relationships could adversely affect the competitiveness of our AI products and services.
• In some cases, these parties are significant customers of Azure and other cloud services.
• The economic benefits we expect to derive from these relationships, including through commercial arrangements, technology access, and Azure consumption, may not be realized or sustained.
• As we manage infrastructure capacity constraints and evolving customer demand, we may modify capacity allocations, deployment priorities, pricing, or other commercial arrangements.
• Strategic partners and other customers may likewise adjust their purchasing decisions, deployment strategies, workloads, or anticipated use of our products and services.
• As a result, expected consumption or anticipated demand may not materialize, may be delayed or reduced, or may decline over time.
• Any such developments could adversely affect our business, financial condition, and results of operations.
• Our success depends on our ability to develop, deliver, and maintain competitive cloud-based and AI products and services that achieve broad customer adoption and sustainable revenue growth.
• Our ability to succeed depends on our ability to develop and deliver differentiated products and services that meet evolving customer needs, achieve broad adoption, maintain customer trust, and generate sustainable revenue and growth.
• The markets for cloud-based and AI products and services are highly dynamic, characterized by shifting customer expectations, increasing regulatory and governmental scrutiny, intense competition, and rapid technological change, such as the accelerating importance of agentic computing.
• Driving customer adoption, usage, and retention of our cloud-based and AI products and services.
• Effectively monetizing our cloud-based and AI products through pricing models that reflect their value while remaining competitive.
• Attracting third parties to utilize, build on, and extend our cloud and AI platforms.
• Our success depends on our ability to execute effectively across product development, go-to-market, customer acquisition, and customer retention initiatives.
• Failure to do so could reduce adoption, market share, and revenue growth.
• This could adversely affect our operations, financial condition, and results of operations.
• Our cloud-based and AI products and services may be misused by customers, users, or malicious actors for unintended, fraudulent, abusive, or unlawful purposes.
• Our efforts to detect, prevent, and mitigate such misuse may not be successful, which could result in reputational harm, regulatory scrutiny, service disruptions, or adverse impacts on our business, financial condition, and results of operations. 16 PART I Item 1A RISKS RELATING TO THE EVOLUTION OF OUR BUSINESS We make significant investments in products and services that may not achieve expected returns.

Reworded 96

Removed words are struck through; added words are highlighted.

• Competition in the technology sector Our competitors range in size from diversified global companies with significant research and development resources to small, specialized firms whose narrower product lines who may let them be more effective in deploying technical, marketing, and financial resources.
• We face significant competition from competing platforms developed for new devices and form factors such as types of devices, including smartphones and tablets.
• To compete, compete successfully, we must successfully enlist developers to write applications for our platform and ensure that these applications have high quality, security, customer appeal, and value.
• Competitors rules governing their content and applications marketplaces may restrict our ability to distribute products and services through them in accordance with our technical and business model objectives. 14 PART I Item 1A For all of these reasons, we may not be able to compete successfully against our current and future competitors, which could adversely affect our business, operations, financial condition, and results of operations. 16 PART I Item 1A Business model competition Companies compete with us based on a growing variety of business models.
• A material part of our business involves cloud-based services available across the spectrum of computing devices.
• We and our competitors continue to devote significant resources to developing and deploying cloud-based strategies and services for consumers and business customers, and pricing and delivery models are evolving. customers.
• We are investing in artificial intelligence ( AI ) across the entire company and infusing generative AI capabilities into our consumer and commercial offerings.
• Some companies compete with us by modifying and then distributing open source open-source software at little or no cost to end users, developing, making available, or using AI models that are open, and earning revenue on advertising or integrated products and services.
• These firms do not bear the full costs of research and development for the open source open-source products.
• Some open source open-source products mimic the features and functionality of our products.
• Whether we succeed in cloud-based and AI products and services depends on our execution in several areas, including: Continuing to bring to market compelling cloud-based and AI services and products and services that generate increasing traffic and market share.
• Maintaining Making our suite of cloud-based and AI products and services platform-agnostic and maintaining the utility, compatibility, and performance of our cloud-based and AI products and services on the growing array of computing devices, including PCs, smartphones, tablets, gaming consoles, and other devices.
• Ensuring our cloud-based and AI services meet the reliability expectations and specific requirements of our customers and maintain the security of their data as well as help them meet their own compliance needs.
• If we are not effective in executing organizational and technical changes to increase efficiency and accelerate innovation, or if we fail to generate sufficient usage of our new products and services, we the timing or magnitude of any revenue growth may not grow revenue be in line with the infrastructure and development investments described above. these costs.
• These events could adversely affect our business, operations, financial condition, and results of operations. 18 PART I Item 1A CYBERSECURITY, DATA PRIVACY, AND PLATFORM ABUSE RISKS Cyberattacks and security vulnerabilities could lead to reduced revenue, increased costs, liability claims, or harm to our reputation or competitive position.
• Threat actors, including individual and groups of hackers and sophisticated organizations, including nation-states, state-sponsored organizations, or cybercriminal groups, continuously undertake attacks that pose threats to our customers and our internal infrastructure, and we have experienced cybersecurity incidents in which such actors have gained unauthorized access to our systems and data, including customer as well as customer, partner, and supplier systems and data.
• These actors use a wide variety of methods, which include developing and deploying malicious software; exploiting known and known, latent, or potential vulnerabilities or intentionally designed processes in our or third-party hardware, software, or other infrastructure to attack our products and services or gain access to our networks and datacenters; using social engineering and AI-assisted techniques to induce our employees, users, partners, suppliers, or customers to disclose sensitive information, such as passwords, or take other actions to gain access to our data or our users or customers data; or acting in a coordinated manner or conducting coordinated attacks.
• For example, as previously disclosed in our Form 8-K filed with the Securities and Exchange 17 PART I Item 1A Commission on January 19, 2024 and amended on March 8, 2024, beginning in late November 2023, a nation-state associated threat actor used a password spray attack to compromise a legacy test account and, in turn, gain access to Microsoft email accounts.
• Nation-state attacks against us, our customers, suppliers, or our partners have and may continue to intensify due to our transparency to our customers, other stakeholders, and the public about cyberattacks, and during elections or periods of intense diplomatic or armed conflict.
• Challenges or failures in applying to update or apply security patches to all hardware and devices connected to our systems, including end-of-life and end-of-support equipment, have and may continue to result in unauthorized access to our systems and data in the future.
• Inadequate account security or organizational security practices, including those of companies we have acquired or those of the third parties we utilize, have resulted and may result in unauthorized access to our systems and data, including customer systems and data.
• For example, passwords may not be rotated and employee access may not be updated or removed on a timely basis.
• Employees or third parties may intentionally compromise our or our users security or systems or reveal confidential information, and laws in foreign certain jurisdictions may compel actions by such parties against our interests and could limit our recourse.
• Cyberthreats are constantly evolving and becoming increasingly sophisticated and complex, increasing the difficulty of preventing, detecting and successfully defending against them.
• As a result of these and other factors, we may not be able to provide prompt, full, and reliable information about the incident to our customers, partners, suppliers, regulators, and the public.
• In addition, actions taken to remediate an incident could result in outages, data losses, and disruptions of our services. 19 PART I Item 1A Our internal environment continues to evolve.
• Increasing use of generative AI models AI, including models, algorithms, copilots, and autonomous or semi-autonomous agents, in our internal or third-party systems may create new attack surfaces or methods for adversaries.
• Our business policies and internal security controls may not keep pace with these changes as new emerging threats emerge or the emerging cybersecurity regulations in jurisdictions worldwide. evolving regulatory landscape.
• Threats to to, or attacks on on, our own infrastructure, such as the nation-state attack described in the prior risk factor, have also affected our customers and may do so in the future.
• The reliability of our cloud-based services and the protection of customer data depend on the security of our infrastructure, infrastructure and the security of third-party infrastructure upon which we rely, which includes hardware hardware, software, and other elements provided by third parties.
• Product vulnerabilities can persist even after we have issued security patches if customers have not installed the most recent updates, or if attackers, potentially with the attackers exploited assistance of artificial intelligence, reconstruct and exploit the vulnerabilities before patching to install additional malware to further compromise customers systems. patching.
• Adversaries will continue to attack customers using our cloud services as customers they embrace digital transformation.
• Open source Additionally, open-source software can also contain vulnerabilities that may make our products susceptible to cyberattacks as we increasingly incorporate open source open-source software into our products.
• As a result, we may not be able to discontinue support in of our services for a product, service, standard, or feature solely because a more secure alternative is available.
• Further, customers Customers of widely varied sizes and technical sophistication use our technology, and consequently may still have limited capabilities and resources to help them adopt and implement state-of-the-art cybersecurity practices and technologies.
• This includes continuously engineering more secure products and services, and enhancing security, threat detection, and reliability features. features, including through the deployment of AI-based and automated defenses.
• In addition, we must develop mitigation technologies that help to secure customers from attacks even 19 PART I Item 1A when software updates are not deployed, and maintain the digital security infrastructure that protects the integrity of our network, products, and services.
• Customers and third parties granted access to customer systems may fail to update their systems, continue to run software or operating systems we no longer support, may fail to timely install or enable security patches, or may otherwise fail to adopt adequate security practices. practices, including in response to enhanced AI-based threats.
• Our license agreements typically contain provisions that eliminate or limit our exposure to liability, but there is no assurance these provisions will may not withstand legal challenges.
• Despite our efforts to improve the security controls across our business groups and geographies, it is possible our Our security controls over personal data, our training of employees and third parties on data security, and other practices we follow may not prevent the improper disclosure or misuse of customer or user data we or our vendors store and manage.

Removed since the previous 10-K 50

• We face significant competition from firms that provide competing platforms.
• Shifting a portion of our business to a vertically-integrated model may increase our cost of revenue and reduce our operating margins.
• Competitors rules governing their content and applications marketplaces may restrict our ability to distribute products and services through them in accordance with our technical and business model objectives.
• We will bear significant development and operational costs to build and support the AI models, services, platforms, and infrastructure necessary to meet the needs of our customers.
• Our focus on cloud-based and AI services presents execution and competitive risks.
• We are incurring significant costs to build and maintain infrastructure to support cloud-based and AI services, reducing operating margins.
• Continuing to enhance the attractiveness of our cloud platforms to third-party developers.
• Making our suite of cloud-based services platform-agnostic, available on a wide range of devices and ecosystems, including those of our competitors.
• It is uncertain whether our strategies will continue to attract users or generate the revenue required to succeed.
• This could adversely affect our operations, financial condition, and results of operations. 17 PART I Item 1A Our AI systems offer users powerful tools and capabilities.
• However, there may be instances where these systems are used in ways that are unintended or inappropriate.
• In addition, some users may also engage in fraudulent or abusive activities through our cloud-based and AI services, such as unauthorized account access, payment fraud, or terms of service violations including cryptocurrency mining or launching cyberattacks.
• While we are committed to detecting and controlling such misuse of our cloud-based and AI services, our efforts may not be effective, and we may incur reputational damage or experience adverse impacts to our business and results of operations.
• RISKS RELATING TO THE EVOLUTION OF OUR BUSINESS We make significant investments in products and services that may not achieve expected returns.
• ( Activision Blizzard ).
• In January 2023 we announced the third phase of our OpenAI strategic partnership.
• In addition, an acquisition may be subject to challenge even after it has been completed.
• Malicious actors may employ the supply chain to introduce malware through software updates or compromised supplier accounts or hardware.
• Threat actors may also utilize emerging technologies, such as AI and machine learning.
• Security of our products, services, devices, and customers data The security of our products and services is important in our customers decisions to purchase or use our products or services across cloud and on-premises environments.
• Weaknesses in our development processes can result in vulnerabilities in our products.
• Additionally, features that rely on generative AI can be susceptible to security threats.
• Any of the foregoing events could result in reputational harm, loss of revenue, increased costs, or otherwise adversely affect our business, financial condition, and results of operations. 20 PART I Item 1A Development and deployment of defensive measures To defend against security threats to our internal infrastructure, our cloud-based services, and our customers systems, we must take a complex and multifaceted approach.
• When discovered by users and others, such content may negatively affect our reputation, our brands, and user engagement.
• Regulations and other initiatives have been enacted to make platforms responsible for preventing or eliminating harmful content online, and we expect this to continue with focused attention on child safety.
• At the same time, regulations and other initiatives regarding freedom of expression may conflict with such content moderation regulations.
• The legal and regulatory environment in this area is complex and continues to evolve across multiple jurisdictions.
• As a result, there is considerable uncertainty regarding both current and future compliance obligations.
• These risks, if realized, may increase our costs, damage our reputation, or adversely affect our results of operations. 22 PART I Item 1A Issues in the development, deployment, and use of AI may result in reputational or competitive harm or liability .
• We are building AI into many of our offerings, including our productivity services, and we are also making AI available for our customers to use in solutions that they build.
• This AI may be developed by Microsoft or others, including our strategic partner, OpenAI.
• We expect these elements of our business to grow.
• We envision a future in which AI operating in devices, applications, and the cloud helps our customers be more productive in their work and personal lives.
• As with many innovations, AI presents risks and challenges that could affect its adoption, and therefore our business.
• AI algorithms or training methodologies may be flawed.
• Finally, if we enable or offer AI solutions that have unintended consequences, unintended usage or customization by our customers and partners, are contrary to our responsible AI policies and practices, or are otherwise controversial because of the impact on human rights, privacy, employment, or other social, economic, or political issues, our reputation, competitive position, business, financial condition, and results of operations could be adversely affected.
• OPERATIONAL RISKS We may have excessive outages, data losses, and disruptions of our online services if we fail to maintain an adequate operations infrastructure.
• The cost or availability of these dependencies could be adversely affected by a variety of factors, including the transition to a clean energy economy, local and regional environmental regulations, and geopolitical disruptions.
• Maintaining, securing, and expanding this infrastructure is expensive and complex, and requires development of principles for datacenter builds in geographies with higher safety and reliability risks.
• Capacity available to us may be affected as competitors use some of the same suppliers and materials for hardware components.

Source: SEC EDGAR filings, compared sentence by sentence by EdgarStack. Sentence matching is automated and may pair or split passages imperfectly; check the linked filings before relying on any passage. A software tool, not financial advice. Not affiliated with the U.S. Securities and Exchange Commission.